Is CVE-2026-34392 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-34392 being exploited in the wild.

How severe is CVE-2026-34392?

High severity, with a CVSS score of 7.5, published 8 April 2026.

Which products and versions are affected?

aces LORIS >= 20.0.0, < 27.0.3; 28.0.0.

Is there a fix for CVE-2026-34392?

A patch was published on 2026-04-08. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-34392 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-34392?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-34392: aces LORIS path traversal in static file router

Q: Is there a fix for CVE-2026-34392?

A patch was published on 2026-04-08. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-34392 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-34392?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-34392 · Severity: high · CVSS 7.5 · Published 2026-04-08

LORIS is a web-based platform used by researchers to manage neuroimaging data and project information. A security flaw in how the application handles requests for website files (like styles and scripts) allows an attacker to access and download sensitive files from the server that should be private. This could lead to the exposure of confidential research data or system configuration files.

Quick answers

Is CVE-2026-34392 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-34392 being exploited in the wild.
How severe is CVE-2026-34392?: High severity, with a CVSS score of 7.5, published 8 April 2026.
Which products and versions are affected?: aces LORIS >= 20.0.0, < 27.0.3; 28.0.0.
Is there a fix for CVE-2026-34392?: A patch was published on 2026-04-08. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-34392 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-34392?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A path traversal vulnerability exists in the ModuleFileRouter.php component of LORIS. The application fails to properly validate user-supplied paths in the static file router, allowing an attacker to use traversal sequences to escape the intended directory. By sending specially crafted requests to the /static, /css, or /js endpoints, a remote, unauthenticated attacker can read sensitive files on the underlying file system. The vulnerability is rooted in the lack of path normalization (e.g., using realpath()) before serving files. Patches in versions 27.0.3 and 28.0.1 address this by verifying that the resolved file path remains within the designated base directory.

Affected products

aces LORIS >= 20.0.0, < 27.0.3; 28.0.0

Timeline

2026-04-08: disclosed
2026-04-08: advisory
2026-04-08: patched

References

https://github.com/aces/Loris/security/advisories/GHSA-rfj5-58hv-wc5f

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.